Cloudflare details Yandex data center strikes and bot migrations

Ukrainian drones struck data centers operated by Russian technology company Yandex, and Ukrainian President Volodymyr Zelenskyy claimed that Russian-run bot networks and political disinformation efforts on platforms like X dropped sharply after the strikes, Mashable reported. After the strikes, social media users spread the idea that Ukraine had disabled a large Russian bot operation, according to the report.

Cloudflare, which monitors internet traffic, published a report saying the event was more complicated than that narrative suggests. The company found that the drone strikes did interrupt some bot activity, but the operators behind those bots were able to move their automated systems to alternative cloud providers and continue running undeterred, Mashable reported. Cloudflare also said it could not determine whether the disruption changed anything for social media campaigns in particular.

Part of the confusion comes from using the word "bot" to describe different activities, Mashable noted. Cloudflare's Radar defines bot traffic as automated website requests on its network, like crawlers and scripts, rather than social media activity. Radar also cannot observe HTTP traffic headed to any particular customer, such as X or Reddit, and cannot identify the hosting locations for accounts posting on those platforms.

Cloudflare's Radar service observed that traffic from Yandex Search fell 99 percent below its pre-attack baseline, while traffic from Yandex.Cloud fell 90 percent below baseline after the attack. Bot requests from Yandex.Cloud fell 40 percent, while traffic in attack-like categories fell 90 percent or more. Cloudflare noted that much of the lost traffic came from innocuous bots such as search crawlers.

Cloudflare said Yandex Search traffic is mostly from verified crawlers that index pages, images and site content, which is normal for a search engine operator. Yandex.Cloud, by contrast, is the company's cloud computing service, where Cloudflare sometimes finds malicious bot traffic.

Cloudflare described a gambling-sector case where almost all bot requests from Yandex.Cloud targeted a single gambling customer account and moved among that account's hostnames. Right after the October 8 disruption, those requests stopped, while the same requests started coming from other Russian hosting autonomous system numbers, according to Cloudflare.

Some social media commentators interpreted Cloudflare's data as showing the attacks severely disrupted social media bots, but Mashable said that reading is not supported because Cloudflare's Radar cannot see traffic to individual social platforms. Cloudflare's report concluded: "Based on our assessment, the data does not appear to support the claims that the strikes crippled social media manipulation, though without further analysis with data outside of Cloudflare, we cannot conclusively say there is no connection".

Cloudflare confirmed that Yandex services suffered major outages and some malicious bot activity dropped, but the bot operators quickly relocated, and the company could not determine whether the disruption affected social media campaigns. The company said further analysis using data outside Cloudflare would be needed to rule out any connection between the strikes and social media manipulation.